Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When I have send a request to an application running on a machine which following firewall rules are applied, it waits so long. When I have deactivated the iptables rule, it responses immediately. What makes communication so slow?

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -i ppp+ -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i lo -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

UPDATED.

ftp -inv <<! > $FTPLOG
open $_FTP_HOST
user $_FTP_USER $_FTP_PASS
mkdir $_FTP_COPY_TO_FOLDER
cd $_FTP_COPY_TO_FOLDER
lcd $BACKUP_SAVE_DIR
bin
put $BACKUP_FILE_NAME
quit
!

here is ftp connection

ftp> ls
200 Port command successful
150 Opening data channel for directory list.
share|improve this question
    
Which application? –  MadHatter Oct 10 '12 at 14:54
    
It simple Socket application, just assume that it is simple server-client application. –  mmc18 Oct 10 '12 at 15:00
    
Did you try a tcpdump yet to check in which phase of the connection it's getting slow? Also, what might be the case - wildy guessing here - is that the machine from which you want to connect to the server doesn't have a proper reverse lookup in DNS. So if the application you want to connect to tries so get the hostname of that IP-address, it'll wait for an answer from DNS (regulary hacing this problem at a customer on machines which don't have proper DNS or unpopluated /etc/hosts) –  Alexander Janssen Oct 10 '12 at 17:12

1 Answer 1

You should remove this rule because it is redundant:

-A INPUT -i lo -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

These rules are processed in constant time with no state data and are extremely unlikely to be the problem:

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -i ppp+ -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -i lo -j ACCEPT

These rules tend to be efficient and are not likely the cause unless you have an extremely large number of open TCP connections:

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

This rule is the most expensive one you have, due to the logging and more importantly the limit rule:

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

Try removing the last one and see if performance improves. If it does not, add it back and remove the two state rules to see if performance improves.

However, it depends largely on what you mean by making a request to the application. None of this will apply unless you are making the request via the network, as your rules are all input or forward (though they may be affecting the speed of a query made to the network from that host). Does the operation ever finish?

share|improve this answer
    
I have just realized that problem is occred because of FTP connection, after establishment of ftp connection, cd,ls commands does not response,I think these are blocked by firewall. so I have to define new rule that allow ftp connection which use special ports. But I though that "A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT " should make it happen. But it did not somehow. I have updated with my ftp script. –  mmc18 Oct 10 '12 at 16:53
    
If you use passive-mode FTP, the server starts listening on a random port (that's what the PORT command is for), but if your firewall is only allowing inbound packets that relate to established connections on arbitrary ports, your firewall is blocking it. Use active mode (and unblock the static FTP data port) if you want to have a host running FTP behind a firewall. –  Falcon Momot Oct 11 '12 at 6:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.